7 Commits

Author	SHA1	Message	Date
Chris Jerdonek	5d80843ebc	Fixed #32800 -- Changed CsrfViewMiddleware not to mask the CSRF secret. ... This also adds CSRF_COOKIE_MASKED transitional setting helpful in migrating multiple instance of the same project to Django 4.1+. Thanks Florian Apolloner and Shai Berger for reviews. Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>	2021-11-29 10:47:39 +01:00
Chris Jerdonek	3f0025c18a	Refs #32800 -- Avoided use of _does_token_match() in some CSRF tests.	2021-11-16 11:21:30 +01:00
Chris Jerdonek	7132341255	Refs #32800 -- Renamed _compare_masked_tokens() to _does_token_match().	2021-08-03 07:10:31 +02:00
Ram Rachum	5b09354954	Fixed #31291 -- Renamed salt to mask for CSRF tokens.	2020-02-25 14:16:19 +01:00
Claude Paroz	2366100872	Removed unneeded force_text calls in the test suite	2017-01-24 18:45:54 +01:00
Shai Berger	5112e65ef2	Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them ... Note that the cookie is not changed every request, just the token retrieved by the `get_token()` method (used also by the `{% csrf_token %}` tag). While at it, made token validation strict: Where, before, any length was accepted and non-ASCII chars were ignored, we now treat anything other than `[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for backwards-compatibility, are accepted and replaced by 64-char ones). Thanks Trac user patrys for reporting, github user adambrenecki for initial patch, Tim Graham for help, and Curtis Maloney, Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne for reviews.	2016-05-19 05:02:19 +03:00
Tim Graham	70be31bba7	Fixed #24836 -- Made force_text() resolve lazy objects.	2015-05-27 09:48:53 -04:00